feat(sealed): author + persist sealed group templates (§11 tail M2)

Thread `sealed` from the manifest through to the DB column:
- manifest: `sealed` on ManifestRoute + the four event-kind trigger specs
  (Kv/Docs/Files/Pubsub), flowing to Bundle via serde.
- persist: NewRoute.sealed + insert_route_tx; insert_trigger_tx `sealed`
  param; the reconcile passes br.sealed / bt.sealed().
- validate_bundle_for rejects `sealed` on an app owner (meaningless — an
  app route/trigger is never inherited).
- diff: `sealed` joins the route Update comparison and the trigger identity
  (both bundle + current sides), so toggling it re-applies rather than NoOp.

`sealed` lives on shared Route + manager-core Trigger (both pure DTOs) so
the diff can see the current value; RouteRow/TriggerRow default it so
RETURNING clauses that omit it still hydrate. No runtime read effect yet —
the two suppression gates land in M3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/shared/src/route.rs

@@ -109,5 +109,13 @@ pub struct Route {
     #[serde(default = "crate::default_true")]
     pub enabled: bool,
 
+    /// §11 tail: `true` for a sealed group route TEMPLATE — a descendant app's
+    /// `[suppress]` cannot decline it, so the RouteTable rebuild keeps it in the
+    /// app's slice even at a suppressed path. Always `false` for an app-owned
+    /// route (sealing an un-inherited route is rejected at apply). Consulted
+    /// only at rebuild via `list_effective`; the request hot path never reads it.
+    #[serde(default)]
+    pub sealed: bool,
+
     pub created_at: DateTime<Utc>,
 }